Privacy & Cookie Policy

Last updated October 3, 2026

This Privacy & Cookie Policy explains how The Broadway Drop Shop LLC (“we,” “us,” or “the Shop”) collects, uses, shares, and protects your personal information when you visit thebroadwaydropshop.com or buy from us, online or in person. We are an independent, fan-owned shop; see our Legal Notice for how our products relate to the shows that inspire them.

Information we collect

Information you provide

• Account: email address and the display alias you choose.
• Orders: shipping name, postal address, and phone number for delivery. Card payments are processed by Stripe — we never receive or store your full card number.
• Membership: Pro subscription status and billing handled through Stripe.
• Support, returns & custom requests: your name, email, message, and any photos or files you attach.

In-person sales

• Payment: your card is processed by Stripe; we never receive or store your full card number.
• Email (optional): used to send your receipt and kept with the sale record. We add it to our marketing list only if you tick “Sign me up to hear about new merch drops.”
• Sale records: the items, prices, discounts, and sales tax, kept for accounting and tax purposes.

Information collected automatically

• Device and usage data, IP address, and approximate location, used for security, rate-limiting, and fraud/bot prevention.
• Cookies and similar technologies — see the Cookies section below. Analytics and marketing cookies load only after you consent.

How we use your information

• To operate the drop queue, process orders, and ship products.
• To manage Pro memberships and process payments.
• To respond to support, return, and custom-design requests.
• To send transactional email (order confirmations, shipping updates) and, where you have opted in, marketing email.
• To secure the site, prevent abuse, measure traffic, credit the affiliate who referred you, and (with consent) measure marketing.

Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on: contract (to fulfil orders and memberships), legitimate interests (to secure the site and prevent fraud), consent (for analytics/marketing cookies and marketing email, which you may withdraw at any time), and legal obligation (e.g. tax/accounting records).

How we share information

We do not sell your personal information. We share it only with service providers (“processors”) who help us run the Shop, each bound to protect it:

• Supabase — account database and authentication.
• Stripe — payment and subscription processing, in-person card readers, and sales-tax calculation.
• EasyPost — shipping labels and tracking.
• Resend — transactional email delivery.
• EmailOctopus — marketing email list (opt-in).
• Rewardful — affiliate/referral tracking (consent-based).
• Cloudflare Turnstile — bot/abuse prevention.
• Google (Tag Manager/Analytics), Meta (Pixel & Conversions API), Reddit (Pixel), and TikTok (Pixel) — analytics and advertising measurement (consent-based); with consent, Meta also receives hashed identifiers, IP address, and device information server-side for attribution.
• Vercel (hosting), Upstash (queue/session storage), and Sentry (error monitoring; may log technical identifiers).

We may also disclose information to comply with law, enforce our Terms, or protect our rights and users.

Data retention

We keep personal information for as long as your account is active or as needed to provide the Shop, then for any period required for legal, tax, or accounting purposes. Order records are retained as required by law. Queue and session data is short-lived.

Your rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict our use of your personal information, and to object to processing or withdraw consent. To exercise these rights:

• You can delete your account and associated data yourself from your account settings, which cancels any subscription and removes you from marketing lists.
• You can change your cookie choices any time using the “Cookie Preferences” control in the Cookies section below.
• For any other request, email us at our support inbox.

U.S. state privacy rights

If you are a California (or other applicable U.S. state) resident, you have the right to know what personal information we collect, to request deletion, and to opt out of “sale” or “sharing” of personal information for cross-context behavioral advertising. We do not sell your data; because our analytics and advertising trackers — including cookies, Meta’s server-side Conversions API, Reddit Pixel, and TikTok Pixel — activate only with your opt-in consent, declining (or rejecting via “Cookie Preferences”) serves as your opt-out. We also honor the Global Privacy Control (GPC) browser signal: if your browser sends a GPC signal, marketing cookies are automatically blocked without any action on your part. We do not discriminate against you for exercising these rights.

International transfers

We are based in the United States and our providers may process data in the U.S. and other countries. Where required, transfers from the EEA/UK rely on appropriate safeguards such as Standard Contractual Clauses.

Security & children

We use reasonable technical and organizational measures to protect your information, though no method is perfectly secure. The Shop is not directed to children under 13 (or 16 in the EEA/UK), and we do not knowingly collect their data.

Changes & contact

We may update this policy from time to time; material changes will be posted here with a new “Last updated” date. Questions or requests: our support inbox — The Broadway Drop Shop LLC.